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The Seasat spacecraft failed on October 9, 
1978, after satisfactory operation in orbit for 
105 days, as a result of a loss of electrical 
power in the Agena bus that was used as a 
part of the spacecraft. The loss of power was 
caused by a massive and progressive short in 
one of the slip ring assemblies that was used 
to connect the rotating solar arrays into the 
power subsystem. The most likely cause of 
this short was the initiation of an arc be- 
tween adjacent slip ring brush assemblies. 
The triggering mechanism of this arc could 
have been either a wire-to-brush assembly 
contact, a brush-to-brush contact, or a mo- 
mentary short caused by a contaminant that 
bridged internal components of opposite elec- 
trical polarity. 

The slip ring assembly, as used in the 
Seasat spacecraft, was connected into the 
power subsystem in such a way that most of 
the adjacent brush assemblies were of oppo- 
site electrical polarity. This wiring arrange- 
ment, together with the congested nature of 
the design itself, made the Seasat slip ring 
assembly a unique, flrst-of-a-kind component 
that was particularly prone to shorting. 

The possibility of slip ring failures result- 
ing from placing opposite electrical polarities 
on adjacent brush assemblies was known at 
least as early as the summer of 1977 to other 
projects within the contractor’s organization. 
Furthermore, failures of slip ring assemblies 
due to shorting between brushes had been 
experienced by the prime contractor on the 
slip ring assemblies used by other programs. 
That the Seasat organization was not fully 
aware of these potential failure modes was 
due to a breakdown in communication within 
the contractor’s organization. 

In addition to this small, though fatal, 
breakdown in communications, the failure to 
give the slip ring assembly the attention it 
deserved was due, in large part, to an under- 


lying program policy and a pervasive view 
that Seasat’s Agena bus was a standard, 
well-proven piece of equipment that had 
been used on other programs. In actuality, 
however, three major subsystems — the elec- 
trical power subsystem, the attitude control 
subsystem, and the data subsystem — were 
substantially modified for use on Seasat s 
Agena bus. So firmly rooted was this princi- 
ple of using a “standard Agena bus” that, 
even after the engineering staffs of both the 
government and the contractor were well 
aware of the final uniqueness of their bus, 
the words, and the associated way of doing 
business, persisted to the end. 

The point of view that the Seasat bus was 
flight proven, standard equipment proved to 
have far-reaching consequences. It became 
program policy to minimize testing and docu- 
mentation, to qualify components by similar- 
ity wherever possible, and to minimize the 
penetration into the Agena bus by the gov- 
ernment. It led to a concentration by project 
management of the sensors, sensor integra- 
tion, and the data management system to the 
near exclusion of the bus subsystems. Impor- 
tant component failures were not reported to 
project management, a test was waived with- 
out proper approval, and compliance with 
specifications was weak. The component that 
failed — the slip ring assembly— was never 
mentioned in the briefing charts for either 
the Consent to Ship meeting or the Critical 
Design Review. 

The Failure Modes, Effects and Critical- 
ity Analysis that was conducted for the elec- 
trical power subsystem did not consider 
shorts as a failure mode and thus did not re- 
veal the presence of single point failure 
modes in the system or provide a basis for the 
development of a full complement of safing 
command sequences that could be used by 
the flight controllers in responding to 
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anomalies in the power subsystem. A lack of 
clarity and rigor in the operating require- 
ments and constraints documents for the 
power subsystem of the bus, together with 
this lack of safing command sequences, pre- 
vented the flight controllers from having all 
the tools they needed to do their job. The 
flight controller for the power subsystem was 
also new to his job at the time of the failure 
and thus was not sufficiently knowledgeable 
of the system he was controlling. While no 
action of the flight controllers contributed to 
the failure, they did fail to follow the pre- 
scribed procedures in response to the infor- 
mation available to them at the time of the 
failure. 

The advantages of using standard, well 
proven equipment in terms of both cost and 
mission success are well recognized. But the 
experience of Seasat illustrates the risks that 
are associated with the use of equipment that 
is classified as “standard” or “flight proven.” 
The uncritical acceptance of such classifica- 
tions by the Seasat engineering staff sub- 
merged important differences in both design 
and application from previously used equip- 
ment. It is therefore important that thorough 
planning be conducted at the start of a 
project to fully evaluate the heritage of pre- 
viously used equipment and to establish 
project plans and procedures that enable the 
system to be selectively penetrated. 

The Seasat Mission and Its 
Spacecraft 

The Seasat Project was a proof-of-concept 
mission whose objectives included demon- 
stration of techniques for global monitoring 
of oceanographic and surface meteorological 
phenomena and features, provision of 
oceanographic data for both application and 
scientific areas, and the determination of key 
features of an operational ocean dynamics 
monitoring system. 

To fulfill these objectives, the Seasat sen- 
sor complement comprised a radar altimeter 
(ALT), a synthetic aperture radar (SAR), a 


Seasat-A scatterometer system (SASS), a 
scanning multichannel microwave radiome- 
ter (SMMR), and a visual and infrared radi- 
ometer (VIRR). All of these sensors except 
the SAR operated continuously; telemetry 
from them, as well as from all engineering 
subsystems, was sent in real-time when over 
a ground station and recorded on a tape re- 
corder for later transmission to provide data 
for a full orbit. SAR data had to be transmit- 
ted in real-time, without the use of the on- 
board recorder, to specially equipped stations 
because of its high data rate. The normal 
duty cycle for the SAR was four percent. 

The five sensors were integrated into a 
sensor module that provided mounting, ther- 
mal control, power conditioning, telemetry, 
and command support to the instruments. 
The second major element of the spacecraft 
was an Agena bus which provided attitude 
control, electrical power, telemetry and com- 
mand functions to the sensor module. In ad- 
dition to these on-orbit functions, the Agena 
bus also provided injection stage propulsion 
and guidance to orbit. The spacecraft was 
three-axis stabilized with all sensors Earth 
pointing and is shown in its on-orbit configu- 
ration in Figure 1. To provide near global 
coverage, the spacecraft was injected into a 
790 kilometer, near circular orbit with an 
inclination of 108 degrees and a period of ap- 
proximately 101 minutes. Design lifetime 
was one year on orbit, with expendables pro- 
vided for a three-year life. 

The sensors were provided by various 
NASA Centers. The sensor module, the Age- 
na bus and the integration of the sensors, 
sensor module and Agena bus into a space- 
craft was provided by the Lockheed Missies 
and Space Company under contract to the Jet 
Propulsion Laboratory (JPL). 

Responsibility for Seasat project manage- 
ment, mission planning and direction, mis- 
sion operations and experiment data process- 
ing resided at JPL. The Goddard Space 
Flight Center (GSFC) provided network 
support and spacecraft orbit and attitude de- 
terminations; use was therefore made of the 
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existing Spaceflight Tracking and Data 
Network, the NASA Communications (NAS- 
COM) network, and the Project Operations 
Control Center that are operated by GSFC. 

To place this failure review in a proper 
perspective, it is noted that the Seasat space- 
craft operated in orbit in a generally satisfac- 
tory maneuver for over three months and 
provided a large amount of scientific data. 
The sensors represented a significant ad- 
vance in technology and their integration 
into the sensor module, a large engineering 
challenge. In addition, Seasat also required 
the creation of significantly enlarged capa- 
bilities in the acquisition and processing of 
flight data. That the important and signifi- 
cant technical and engineering advance- 
ments were achieved is a tribute to the skill 
and dedication of all who were associated 
with this program. 

The Seasat spacecraft was successfully 
launched on June 26, 1978, and thus operat- 
ed for 105 days until the failure occurred on 
October 9, 1978. During this time in orbit, 
the spacecraft operation was generally satis- 
factory with considerable data being ob- 
tained from all of the sensors. Three signifi- 
cant anomalies were experienced during the 
life of Seasat in orbit, one involving sun in- 
terference in the attitude control system scan 
wheels, one caused by a sticking thermostat 
in a sensor heater circuit, and one in which 
the spacecraft suffered an abnormally low 
bus voltage for several orbits. Because of a 
possible relationship of these latter two 
anomalies with the failure of October 9, 
1978, they were specifically investigated by 
the Board. 

Program History and Management 

The Seasat program was conceived and 
initiated in a period of transition in the 
philosophy of management of NASA pro- 
grams following the Apollo program. Apollo, 
and to varying degrees other NASA flight 
programs, were characterized by extensive 
test programs, large formal documentation 


systems, and comprehensive and frequent 
technical and management reviews. A large 
in-house staff was required in order to imple- 
ment this approach. The high cost of conduct- 
ing space programs in this mode severely 
constrained the future uses of space. During 
the final phases of the Apollo program, 
NASA management accordingly instituted a 
policy aimed at reducing the cost space mis- 
sions. This policy was aggressively pursued 
by the highest levels of management. 

A Low Cost Systems Office was estab- 
lished in Headquarters to oversee a stan- 
dardization program and to encourage the 
use of existing hardware. This program in- 
cluded the development of standard compo- 
nents as well as a multimission spacecraft. 

A major emphasis was placed on shifting 
work from in-house to out-of-house in consid- 
eration of reducing the NASA manpower 
base. Design-to-cost techniques and cost 
benefits of heritage through the use of hard- 
ware and software developed for other pro- 
grams were subjects to be addressed at each 
step in the approval cycle. 

The basic philosophy of the Seasat pro- 
gram was thus established in an environ- 
ment in which management emphasis was 
shifting from one of demonstrating a nation- 
al capability to operate reliably in space to 
one of reducing the cost of utilizing space. 
Design-to-cost was a fundamental tenet of 
the Seasat project definition. A cost estimate 
of $58.2 million was established as a target 
cost at the end of the feasibility study phase 
in mid-1973 and was imposed as a design-to- 
cost ceiling in December 1973 by NASA 
management. Any overruns were to be offset 
by descoping the mission content. 

In attempting to define a program which 
would both satisfy the user community and 
live within the ceiling cost, the concept of 
making maximum use of proven existing 
hardware and software was adopted early in 
the program planning phase. This in turn 
provided for a reduction in design and devel- 
opment effort and in the size of the in-house 
staff needed to monitor the activity. 
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Figure I On-Orbit Configuration of the Seasat Spacecraft 


These were key elements of the manage- 
ment philosophy which influenced the struc- 
ture and conduct of the program. 

Program Planning 

Feasibility Studies (Phase A) - Feasi- 
bility for the Seasat mission was established 
in ‘73 through three studies conducted by the 
JPL, GSFC, and the Applied Physics Labora- 
tory of the Johns Hopkins University. These 
studies were aimed at meeting the set of user 
requirements generated at a series of meet- 
ings held in the first half of 1973 among 
NASA and representatives of the govern- 
mental, commercial, and institutional com- 
munities of users of ocean dynamics data. 


With the user requirements as a basis, the 
feasibility studies examined the Seasat mis- 
sion from an overall systems viewpoint, in- 
cluding a review of instrumentation and pos- 
sible spacecraft (bus) approaches to accom- 
modate the instrumentation. 

Subsequent to the submission of the 
Phase A studies in July 1973, a joint 
NASA/User Study Task Team was formed to 
review the Phase A studies, integrate the 
results, and provide technical and program- 
matic guidance for more in-depth Definition 
Phase studies. 

As a result of this review, the Task Team 
recommended a Baseline Mission which in- 
cluded a complement of the five sensor types 
that actually ended up flying on Seasat. 
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Based upon cost estimates prepared by 
the Phase A study participants, the Task 
Team recommended a target cost of $58.2 
million for the Baseline Mission. This includ- 
ed the cost of the spacecraft bus and instru- 
ments, the launch vehicles, and tracking and 
data acquisition. An Alternate Payload Mis- 
sion of reduced capability, excluding the syn- 
thetic aperture radar, was also recommended 
for further study with a target cost of $43.2 
million. 

There was some discussion in the Seasat 
Study Study Task Team Report (October 
1973) of the use of an existing bus to mini- 
mize cost. The idea, however, was addressed 
with some skepticism. While it was believed 
that the use of subsystems with a high de- 
gree of inheritance from existing programs 
was desirable and possible, it was not clear at 
that time that an existing bus could be 
adapted economically. 

Definition Studies and Preliminary 
Design (Phase B) - Definition Phase Studies 
of the Baseline and Alternate Payload Mis- 
sions recommended by the Seasat Study 
Task Team were conducted from November 
1973 to the summer of 1974. The Wallops 
Flight Center managed the Definition Phase 
Study of the Baseline Mission which was con- 
ducted by the Applied Physics Laboratory. 
The JPL, assisted by various aerospace com- 
panies familiar with Earth satellite design, 
conducted the Definition Phase Study of the 
Alternate Mission. 

In December 1973, NASA management 
adopted the $58.2 million figure recommend- 
ed by the Task Team as a not to exceed ceiling 
for the Seasat Baseline Mission. The efforts 
of the Definition Phase Study participants 
were accordingly intensified to develop the 
most economical satellite system possible 
that would best suit the user requirements 
within the cost ceiling. 

GSFC declined to participate in the Defi- 
nition Phase activity as they had serious 
doubts as to their ability to structure a full 


Baseline Mission within the design-to-cost 
ceiling. 

With the stimulus of the design-to-cost 
ceiling, and management emphasis on the 
maximum use of existing subsystem hard- 
ware, the JPL Definition Phase Group pro- 
posed the of idea building a spacecraft sys- 
tem comprising two major elements: a sensor 
module designed specifically for Seasat, and 
a spacecraft bus based on an existing, flight 
proven bus devloped for other Air Force or 
NASA programs. The JPL viewed the results 
of the Phase A studies as indicating that the 
requirements of the sensors could be satisfied 
by standard support subsystems for attitude 
control, power, structures, thermal control, 
etc. On the other hand, the area of greatest 
uncertainty was seen to be the definition of 
the sensor’s operating capabilities, data re- 
quirements and sensor system integration. It 
was therefore proposed that if a suitable 
spacecraft bus were available, the design and 
development effort could be concentrated on 
the sensors and their integration with a sen- 
sor module that could then be mated to the 
bus via a mechanical/electrical interface. 

The JPL entered into four $15,000 study 
contracts with aerospace companies (Boeing, 
General Electric, Lockheed, and TRW) that 
had existing spacecraft designs with capabil- 
ities in the range of Seasat requirements to 
evaluate the concepts that: (1) there are ex- 
isting buses that could be used, without 
modification, to supply the necessary support 
functions for the sensor payload, and (2) new 
design functions could be incorporated in a 
separate module along with the sensors and 
thereby reduce the systems development 
task to a sensor system development task. 
The studies were conducted from November 
15, 1973 to March 30, 1974. The sensors were 
described to the study contractors as they 
were developed on December 15, 1973, with 
updates as appropriate until the end of these 
studies. 

It was concluded as a result of these stud- 
ies that basic sensor support requirements 
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could be satisfied by the existing spacecraft 
bus designs studied with “no major changes,” 
although “minor modifications” were ac- 
knowledged to be required. It was contem- 
plated, for example, that minor modifications 
would be required of the attitude control, 
power, and temperature control subsystems. 
Telemetry, tracking and command subsys- 
tems were reported to be off-the-shelf de- 
signs, but required significant modification. 
It should be noted that the contractor bus 
studies were concerned almost solely with 
mission performance requirements. The re- 
ports did not sufficiently define the sub- 
system design or component selections to 
provide a basis for an adequate penetration 
of heritage. The JPL Definition Phase Final 
Report nevertheless concluded that the exist- 
ing bus approach had significant cost, sched- 
ule and risk advantages, and permitted a 
concentration of development efforts on the 
sensor system. 

Midterm reports in May 1974 of the JPL 
and the Wallops Flight Center and Applied 
Physics Laboratory Definition Phase study 
groups demonstrated that neither the Base- 
line nor Alternate Payload Mission was 
achievable within the $58.2 million ceiling. 
The Wallops Flight Center and Applied 
Physics Laboratory’s estimate for the Base- 
line Mission, which included an in-house de- 
signed spacecraft, was $85.2 million. At this 
point in time the Wallops Flight Center and 
the Applied Physics Laboratory adopted the 
sensor module/existing bus concept that JPL 
was pursuing. JPL’s midterm estimate for 
the Alternate Payload Mission using the ex- 
isting bus concept was $65.9 million. 

The JPL and the Wallops Flight Center 
and Applied Physics Laboratory searched for 
ways to descope the project in order to stay 
within the cost ceiling. Each group per- 
formed a number of iterations wherein sen- 
sor performance and sensor combinations 
were varied in order to decrease the cost and 
yet meet the basic user requirements. 

A final presentation of the JPL and 
Wallops Flight Center and Applied Physics 


Laboratory’s Definition Phase studies to 
NASA Headquarters management in August 
1974 resulted in a reduced baseline payload 
at the $58.2 million ceiling which eliminated 
the microwave radiometer and combined the 
altimeter and scatterometer into a single in- 
strument, but which retained the synthetic 
aperture radar, as well as the visual and in- 
frared radiometer. 

Spacecraft Requirements and 
Documentation 

The two primary contractual documents on 
Seasat were the Satellite Vehicle Specifica- 
tion (Part I and Part II) and the Satellite Ve- 
hicle System Test Plan. There were 13 other 
documents which required JPL approval, but 
these were primarily implementation and 
operations type plans; i.e., Data Manage- 
ment Plan, Quality Assurance Plan, etc. One 
of these plans, the Reliability Assurance 
Plan, is relevant to this chapter and will be 
discussed herein. 

Part I of the Satellite Vehicle Specifica- 
tion established the performance, design, de- 
velopment, and qualification requirements 
for the Seasat mission. Part II of the specifi- 
cation established the product configuration 
and system test acceptance requirements. 
This specification is similar to a typical Part 
I, Part II Contract End Item specification 
used for most NASA programs. 

The Satellite Vehicle Systems Test Plan 
established the test program for assembling, 
testing, monitoring and operating the Seasat 
spacecraft from manufacturing through 
launch. The Satellite Vehicle Systems in- 
cluded all Lockheed and government fur- 
nished hardware installed in the Agena bus 
assembly and the sensor module. The test 
plan was the controlling test document and 
subordinate only to the Satellite Vehicle 
Specification. An evaluation was made re- 
garding this flow of requirements and the in- 
terrelationships of Lockheed and JPL rela- 
tive to control and the visibility of require- 
ments. 
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Compliance with Requirements - Dur- 
ing the Board’s review, it was determined 
that a significant test required by the JPL 
approved test plan was not conducted. The 
Satellite Vehicle Test Plan required elec- 
tronic assemblies to be subjected to eight 
cycles in thermal environment of which, as a 
minimum, two cycles should be in a vacuum 
chamber (acceptance test). The Slip Ring 
Assembly Component Specification, howev- 
er, did not require a thermal vacuum test. 
This noncompliance was not recognized by 
JPL or Lockheed systems engineering until 
the present failure investigation was begun. 
Discussions with Lockheed and JPL person- 
nel revealed that there was not a closed loop 
system to assure compliance with contractu- 
al requirements identified in the test plan. 

The fact that a component specification 
that violated a contractual requirement 
could be issued is indicative of a lack of 
checks and balances in the system. Another 
indication of this lack surfaced in reviewing 
the qualification requirements. In at least 
two cases, to be discussed below, qualifica- 
tion requirements noncompliance was not 
documented. In fact, in the areas where the 
Board performed an in-depth evaluation, in- 
consistencies in requirements were noted in 
many cases. Most inconsistencies were mi- 
nor; however, the impression left was that 
both compliance with requirements by Lock- 
heed and the check and balance system at 
Lockheed and JPL were deficient. 

Engineering Memoranda - Environ- 
mental derivations, test criteria and detailed 
test requirements were documented in engi- 
neering memoranda (EMs). Lockheed stated 
that EMs were used to allow early genera- 
tion of requirements while the spacecraft de- 
sign was being finalized. A considerable 
number of EMs were developed during the 
course of the Seasat program, and it accord- 
ingly became very difficult to establish a 
documentation trail as to how test require- 
ments were established, modified, and satis- 
fied. In fact, two particular incidents were 


uncovered during detailed evaluation into 
the qualification status of the electrical pow- 
er subsystem components that point out the 
weakness of the EM system. 

In one case, the Seasat environmental 
requirements specified a five minute per axis 
random vibration level but several compo- 
nents were qualified by similarity to a pro- 
gram that required only a three minute per 
axis vibration. This five minute per axis 
requirement was also specified in Part I of 
the Satellite Vehicle Specification. There 
was no documented evidence that this non- 
compliance was acceptable. In the second in- 
cident, pyro shock levels for Seasat were not 
enveloped by the program to which the Sea- 
sat slip ring assemblies were “qualified by 
similarity.” While an EM stated that the slip 
ring assemblies are “not highly sensitive to 
pyro shock,” there was no documentation or 
analysis to support the stated conclusion. 

Because Seasat was a one-of-a-kind vehi- 
cle, Lockheed did not summarize the require- 
ments contained in the various EMs into a 
single baseline document. A baseline docu- 
ment, with change control, would have been 
a systematic approach to assuring require- 
ments were satisfied and would have pro- 
vided a feedback mechanism to all parties. 
The large number of EMs produced in the 
Seasat program made it very difficult for 
Lockheed to use the EMs to manage the 
program and to assure continuity in require- 
ments, as exemplified above, and equally 
difficult for JPL to effectively penetrate the 
system. 

The Failure Modes, Effects and 
Criticality Analysis (FMECA) - The 
FMECA prepared for Seasat utilized the 
Fault Tree Analysis Technique. In effect, 
this was a method for studying the factors 
that could cause an undesired event to occur 
and inputting these factors into a computer 
model to which probability data could be 
applied to determine the most critical and 
probable sequence of events that could pro- 
duce the undesirable event. 
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The Reliability Assurance Program Plan 
required that a FMECA be performed at the 
system level. Further evaluation revealed 
that “critical/new equipment” would also be 
subjected to an FMECA. Out of the 74 criti- 
cal items identified on Seasat, only three 
were judged to require component level 
FMECAs. These were the command timing 
unit (CTU), the telemetry sensor unit (TSU) 
and the synthetic aperture radar (SAR) an- 
tenna (supplier performed). 

The FMECA for the electrical power sub- 
system stated that there were “no single 
point failures” and listed a number of redun- 
dancies, including main bus power supply 
channels, batteries, charge controllers, and 
others. Electrical shorts were, however, not 
included as possible failure modes; almost all 
of the effort was directed toward consider- 
ation of failure modes that would result in 
loss of solar array power, and the only slip 
ring assembly failure mode considered was 
“slip ring contact failure.” The lack of consid- 
eration of electrical shorts in effect prevented 
the FMECA from serving as a tool for direct- 
ing attention to those portions of the system 
where electrical shorts could occur and led to 
the erroneous conclusions that there were no 
single point failure modes in the electrical 
power subsystem. 

Component Specifications - Compo- 
nent specifications were used on Seasat to de- 
fine the design, performance, acceptance, 
and qualification requirements of the major 
hardware items and subassemblies. Because 
the program intent was to utilize as much 
off-the-shelf hardware as possible, many ex- 
isting specifications were redlined and up- 
dated for the Seasat Agena bus. These red- 
lined specifications were then converted into 
component specifications by the responsible 
equipment engineers. After April 1976, a 
program directive established that all com- 
ponent specifications on Seasat required the 
signature approval of reliability engineer- 
ing, of space technology, and of the chief sys- 
tems engineer in addition to the responsible 


equipment engineer and the program engi- 
neer. Two specifications were released prior 
to April 1976 and never received the full 
complement of signature approvals. These 
two specifications were for the Slip Ring As- 
semblies and the Solar Array Drive Motors. 
Had the other three engineering organiza- 
tions reviewed the specifications, quite possi- 
bly the Slip Ring Assembly thermal vacuum 
test deletion may have been prevented and 
inconsistencies in the qualification require- 
ments may have been avoided. The compo- 
nent specifications were not reviewed and 
approved by JPL. 

Qualification for Flight - The Seasat 
program used the classical methods of quali- 
fying hardware for flight. These were: 

a) Qualification by test to demonstrate the 
capability of an item to meet specification 
requirements. 

b) Qualification by design similarity where- 
by an unqualified item is compared with 
an item qualified by test to determine 
whether the requirements for both items 
and their configurations are sufficiently 
similar to justify not testing the unquali- 
fied item. 

c) Qualification by engineering analysis, in- 
dependently or in conjunction with test 
and/or similarity, to meet a specific quali- 
fication in the specifications. The use of 
engineering analysis alone could not be 
used to satisfy all qualification require- 
ments. 

In September 1976, the Lockheed Seasat pro- 
ject issued a directive creating an Equipment 
Qualification Review Board for the purpose 
of reviewing and approving all qualification 
and design similarity certificates. The pri- 
mary membership of the board included the 
program engineering managers, the chief 
systems engineer, the program reliability en- 
gineer, the quality assurance manager, and 
the applicable space technology manager. 
This Board met every two weeks to review 
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the status of the qualification program and to 
determine what additional tasks were re- 
quired to qualify a given item. Status reports 
were issued by program reliability engineer- 
ing which tracked the qualification progress 
and documented open items. 

The qualification cycle concluded with a 
meeting to review all test data, design simi- 
larity statements, engineering analyses, and 
individual component pedigree packages. In- 
dividual Certificates of Qualification were is- 
sued stating that the specific component had 
been qualified to the intended environment 
and was acceptable for flight. A JPL engi- 
neering representative attended these quali- 
fication review meetings but was not re- 
quired to approve the qualification certif- 
icate. A JPL reliability representative at- 
tended approximately 25 percent of the re- 
view meetings. 

Review of Build Paper - An evaluation 
of the Seasat “build” paper was made with 
primary attention focused on the electrical 
power subsystem. The review encompassed 
the electrical harness fabrication and instal- 
lation, the “pedigree packages” on electrical 
components and assemblies, nonconformance 
reports on anomalies encountered in assem- 
bly and test, vehicle log books, and the vehi- 
cle acceptance summary. 

Because the Board’s failure analysis 
eventually identified the slip ring assembly 
as the component responsible for the Seasat 
failure, the detailed build paper associated 
with only this component will be discussed in 
the next section. However, some brief obser- 
vations are presented below that deal with 
other findings made during the course of the 
investigation. 

The nonconformance reports are used by 
Lockheed to document nonconforming condi- 
tions and resultant dispositions and correc- 
tion actions. In general, the nonconformance 
report system at Lockheed was found to be 
acceptable. At the Board’s request, Lockheed 
reviewed, cataloged, and summarized all 
electrical power subsystem nonconformance 


reports and made a conscious decision as to 
the possible effect of the anomaly in contri- 
buting to the Seasat failure. None of the non- 
conformances were judged to be contributory 
to the failure. 

Evaluation of the spacecraft build paper 
of the electrical power subsystem indicated 
that the Air Force Plant Representative Of- 
fice involvement, operating under delegation 
from JPL, was shallow. Inspection coverage 
was concentrated at the system level with 
few in-process mandatory inspection points. 

Early negotiations surfaced the fact that 
the Air Force Plant Representative Office 
could provide neither the number of person- 
nel nor the required skill levels to perform 
electronic inspections. As a result of these 
negotiations, JPL elected to send three JPL 
inspectors on extended temporary duty to 
perform 100 percent of the solder joint in- 
spections and electronic component accep- 
tance testing. While it cannot be stated that 
a more in-depth involvement by the govern- 
ment would have prevented the failure, it is 
the opinion of the Board that the depth of 
penetration was inappropriate and a more 
selective penetration would have been in or- 
der rather than a nearly total reliance on 
system level audits and shakedown inspec- 
tions for the bus assembly operations. 

Slip Ring Heritage 

Consistent with the basic philosophy of the 
Seasat program to use, to the maximum ex- 
tent possible, standard flight-proven equip- 
ment, the solar array drive motors and slip 
ring assemblies for Seasat were adapted from 
another Lockheed program. At the time of 
initial contract negotiations, this other Lock- 
heed program had just developed a slip ring 
assembly and was in the process of perform- 
ing qualification testing. This slip ring was 
also being considered for still other Lockheed 
programs and it was anticipated that the as- 
sembly would be a qualified and flight- 
proven design by the time Seasat was flown. 
As it turns out, however, the program for 
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which the design was originally developed 
was canceled after completion of slip ring 
qualification but prior to flight; however, one 
other Lockheed program did fly a slip ring 
assembly of this design shortly before Seasat 
was launched. While the designs of the slip 
ring assembly for Seasat and this “previously 
flown” program were identical, the wiring se- 
quence of the individual rings and brushes 
was different in the two programs. As noted 
earlier, the Seasat slip rings were wired such 
that most of the adjacent power brushes were 
of opposite DC polarity while the other Lock- 
heed program was wired such that the adja- 
cent power brushes had the same polarity. 
This difference in how the slip ring assem- 
blies were connected into the electrical power 
subsystem thus became crucial to the heri- 
tage of the Seasat slip ring assembly; when 
the Seasat slip ring assembly became, in its 
application, connected in a manner that was 
different from its sole predecessor it became 
a unique, first of a kind component. 

Two significant problems were noted as a 
result of random vibration testing of the slip 
ring assemblies used for the other Lockheed 
flight program. An isolation failure was 
found after vibration testing in two adjacent 
brush/ring circuits. The corrective action was 
to separate the brushes. Also, when the as- 
sembly was opened for this operation, a crack 
was noted in the brush mounting block at a 
mounting hole. This block was replaced on 
the failed unit and a “T” strengthener was 
added to all identical slip ring assemblies, in- 
cluding the Seasat units, to distribute the 
mounting loads away from the mounting 
point. 

Failure History - Slip ring assemblies of 
the design flown by Seasat experienced two 
nonconformances that provide evidence of 
two separate failure mode possibilities. One 
of these was the isolation failure noted above 
on the other Lockheed flight program that 
was indicative of a possible failure mode due 
to contact between adjacent brushes of oppo- 
site polarity. Another failure mode identified 


on one of the Seasat assemblies was caused 
by shorting of a wire to ground due to cold 
flow of the Teflon insulation in the region 
where high stresses were imposed on the 
wire. This incident will be described later. 

Considerable evidence exists in published 
reports that the sliding friction between 
brushes and rings will generate debris parti- 
cles that can accumulate and produce electri- 
cal noise or, in some cases, short circuits be- 
tween adjacent rings and brushes. Lockheed 
experienced a shorting failure in a slip as- 
sembly used in ground tests of a control mo- 
ment gyro prior to June 1977, which was at- 
tributed to accumulation of brush-generated 
debris and subsequent arcing between adja- 
cent power brushes. Discussion with engi- 
neering personnel from TRW, Ball Corpora- 
tion, and Sperry Flight Systems have indi- 
cated that other aerospace contractors have 
experienced similar slip ring shorts in 
ground tests. As a result of their experience 
with slip rings, Sperry initiated an experi- 
mental study of the possible effects of debris. 
While the Board recognizes that there are 
significant differences between the design 
and application of the Seasat slip ring assem- 
bly and these other units, experience illus- 
trates a third possible failure mode due to 
shorting caused by contaminants or debris 
within the assembly. 

Seasat Slip Ring History - A portion of 
the build history of components is assembled 
by Lockheed into pedigree packages. These 
packages contain component drawings, a 
component specification including accep- 
tance and qualification test requirements, 
nonconformance reports, and some vendor 
documentation including specified testing 
and plans test records. Component selection 
for pedigree packages was determined by the 
Seasat Program Office and the quality assur- 
ance organization at Lockheed. The Seasat 
slip ring assemblies are documented by such 
pedigree packages. Relevant component his- 
tory not contained in the slip ring pedigree 
packages include vendor assembly and test 
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nonconformance reports (including failure 
reports), assembly test procedures and 
records (including brush alignments and 
pressure checks and brush “run-in” proce- 
dures), and relevant vendor and customer 
correspondence. 

The timing of the Seasat contract was 
such that Lockheed was able to acquire two 
partially assembled slip ring assemblies 
when another Lockheed program referred to 
herein as Program A, was canceled. Program 
A had initially contracted for 10 assemblies 
and, at the time of termination, had accepted 
delivery of one qualification unit, one devel- 
opment unit, and two production units leav- 
ing six partially assembled units at the ven- 
dor. The Seasat program picked up two of 
these units and Lockheed Program B picked 
up the additional units. Reference will be 
made to Program B in other portions of this 
report relative to test experience and use of 
Program B qualification testing as a basis for 
qualifying the Seasat slip rings by similar- 
ity. 

Program A personnel were informed by 
Poly -Scientific in late 1973 that the con- 
straints placed upon the length of the assem- 
bly were found to be restrictive and that re- 
lief of the specifications would enhance reli- 
ability. Program A, however, could not relax 
the specification. Although the Seasat appli- 
cation was not constrained by length, the 
program desire to use available off-the-shelf 
hardware precluded the development of a 
new unit having increased dimensional tol- 
erances between the rings and brush assem- 
blies with possibly enhanced inherent reli- 
ability. 

Seasat personnel initiated discussions 
with Poly-Scientific in late 1975 using the 
Lockheed Program A specification as a base- 
line. On February 3, 1976, Poly-Scientific 
submitted its first written quote for two as- 
semblies to be fabricated and tested per the 
Program A specification. This initial quote 
was not acceptable to Lockheed, and the re- 
sponsible equipment engineer and buyer re- 
sponded on March 5, 1976, with a Seasat red- 


lined version of the Program A specification. 
It was in this March 5, 1976, specification 
that the Program A requirement for 10 cy- 
cles of thermal vacuum acceptance testing 
was deleted. This deletion occurred even 
though: (1) the majority of the Seasat elec- 
tronic assemblies and electromechanical as- 
semblies were subjected to a thermal vacuum 
acceptance test; (2) Seasat reliability and 
systems engineering personnel, and JPL per- 
sonnel were unaware of this deletion until 
the present failure investigation; and (3) the 
thermal vacuum test was contractually re- 
quired and a waiver of the requirement was 
never issued 

Upon pursuing the thermal vacuum dele- 
tion further, it was determined from inter- 
views with involved personnel that the test 
was deleted during verbal negotiations be- 
tween both the responsible equipment engi- 
neer and the buyer at Lockheed, and the ven- 
dor in order to reduce unit cost of the slip 
ring assemblies. The responsible Lockheed 
program engineer approved the deletion but, 
at that time, there was no requirement to co- 
ordinate specifications with the Seasat pro- 
gram reliability engineer or the chief sys- 
tems engineer. The fact that a waiver was 
not issued on this and other contract noncom- 
pliances is indicative of a weak compliance 
system between Lockheed and JPL. 

On March 25, 1976, Lockheed issued a 
formal Request for Quote to Poly-Scientific 
for two Seasat slip ring assemblies built to 
the March 5, 1976 specification with a re- 
quested delivery date of one year. On May 
26, 1976, Lockheed authorized contract go 
ahead for two slip ring assemblies at a unit 
price of $8,953.50. 

Researching the manufacturing history 
and fabrication and test anomalies at Poly- 
Scientific resulted in the following: 

a) There were four anomalies noted on slip 
ri ng unit 1001. Three were minor and ap- 
pear to have had no real impact on assem- 
bly reliability. The fourth anomaly was a 
Teflon wire short to an adjacent ground 
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lug. The repair action, approved by Lock- 
heed engineering, was to insulate the 
ground terminal and repot with ES 222-2 
cement. The damaged insulation on the 
wire was not repaired. This discrepancy 
report was not included in the vendor’s 
data package and consequently this fail- 
ure was not contained in the Lockheed 
pedigree package. 

b) Slip Ring Unit 1002 (-Y solar array) had 
the more significant anomalies noted dur- 
ing fabrication and test. These anomalies 
are summarized as follows: 

1) 9/20/76 - 80 minute run-in of brushes 
to rings at 100+ 10 rpm. Run-in time 
should have been for 100 to 115 min- 
utes. This discrepancy was missed and 
not documented. 

2) 9/23/76 - discrepancy No. 146522 - dis- 
colored rings noted after above run-in 
test. Unit had to be completely disas- 
sembled, brushes and rings recleaned, 
unit reassembled and another run-in 
performed. The exact run-in time was 
not recorded nor entered into the log 
book. 

3) 11/12/76 - discrepancy No. 151887 - ex- 
cessive noise noted caused by moisture 
pick-up in the brush material. Correc- 
tive action was to run the unit in vacu- 
um at 14.4 rpm for 1^ hours. No vacu- 
um cleanup was performed after this 
14.4 rpm run-in test. This run time 
was not entered into the log book. 

c) Review of vendor documentation and sub- 
sequent teleconferences with Poly- 
Scientific personnel revealed the follow- 
ing assembly technique and procedures: 

1) The assembly planning documenta- 
tion specified that the brushes were to 
be aligned “in center of the rings.” 
This requirement was verified visual- 
ly by the inspector, but no dimensional 
checks were made. Proper alignment 
of the brushes is dependent, therefore, 
on the inspector’s judgment. 


2) Poly-Scientific stated that the toler- 
ances within the slip ring assembly 
could allow adjacent brushes to touch. 
It is noted here that an identical slip 
ring assembly experienced an isola- 
tion failure during acceptance testing 
which was probably caused by adja- 
cent brushes touching. (Program B 
hardware). 

Both Seasat slip ring assemblies were 
shipped from Poly-Scientific on February 22, 
1977. These units were received and accepted 
at Lockheed on March 11, 1977, where they 
remained in storage until required for instal- 
lation on their respective solar array mod- 
ules. 

In approximately July 1977, Lockheed 
Program B, which utilized identical slip ring 
assemblies, made a wiring change external 
to the slip rings that separated the polarity 
arrangement of adjacent slip rings. By 
changing connector pin functions, the power 
applied to individual rings was changed from 
a configuration in which adjacent rings were 
of opposite polarity to one having positive 
contacts on one end of the slip ring assembly 
and negative contacts on the opposite end. 
This wiring change significantly reduced the 
possibility of internal shorts within the slip 
ring assembly. 

The Seasat chief system engineer was 
contacted by a system engineer from Pro- 
gram B about this change in wiring in Au- 
gust 1977. The explanation given for the wir- 
ing change was a concern that the ascent vi- 
bration environment could cause adjacent 
brushes to make contact and thus produce an 
electrical short because Program B slip rings 
had power applied during launch. The chief 
system engineer discussed this change with 
the Seasat program engineer and they decid- 
ed not to make a similar wiring change be- 
cause Seasat did not see the same launch vi- 
bration levels and because Seasat slip rings 
were not planned to be powered during 
launch. It is noted that in April 1978, a 
change in launch relay configuration was 
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made which did apply power to the slip ring 
assemblies. In retrospect, the decision not to 
change the wiring sequence for Seasat was a 
crucial one. When the other program 
changed its wiring and Seasat did not, Seasat 
became the first program to fly a 52-brush 
slip ring assembly with adjacent brushes of 
opposite polarity. Had there been better visi- 
bility to the problems experienced with slip 
rings by both the vendor and by other organi- 
zations within Lockheed, the Seasat engi- 
neering managers may have been more sen- 
sitive to the failure prone nature of this com- 
plicated device and to the importance of the 
electrical polarity of adjacent brushes. Un- 
fortunately, such visibility, which may only 
have needed to have been slight to have been 
effective, was lacking. 

Slip Ring Assembly serial number 1002 
was installed on the -Y solar array module on 
August 17, 1977. On August 30, 1977, a non- 
conformance report was written because the 
mechanic “lost” an undetermined number of 
shim washers. 

Review of the installation drawing re- 
vealed that four number 10 washers were re- 
quired between the solar array mounting 
structure and the slip ring assembly. The 
cover of the assembly is made of thin sheet 
metal and is prone to bow up during installa- 
tion operations. Because the mounting bolts 
go through the cover plate into the threaded 
holes in the slip ring body, the mechanic had 
to place the round washers over the bolts be- 
tween the structure and the cover plate. It 
was during this operation that the mechanic 
lost the washers. The S/N 1002 slip ring as- 
sembly was removed from the solar array 
module, the cover plate removed and three 
washers were found. Because some areas 
were still obscured, an x-ray of the slip ring 
was taken. No additional washers were locat- 
ed. A nonconformance report was then writ- 
ten against Slip Ring Assembly 1001 and no 
washers were found by either visual or x-ray 
inspection. It is interesting to note two 
things: (1) there were no downstream electri- 
cal functional checks after installation of the 


slip ring assembly which could have detected 
missing washers in the slip rings, and (2) it 
was never conclusively determined if all lost 
washers were found. 

The solar array modules, including the 
slip ring assemblies, were shipped to the 
launch site in April 1978. The last reported 
anomaly on the slip rings was high contact 
resistance on unit 1002 during interface tests 
performed when the solar array modules 
were mated to the vehicle. The resistance 
reading recorded was 2.38 ohms; the specifi- 
cation value was 2.00 ohms maximum. The 
engineering disposition in the nonconfor- 
mance report was “use-as-is” because in- 
flight operation would decrease the contact 
resistance. 

Significant Findings 

1) The spacecraft failure that occurred on 
October 9, 1978, was due to a loss of elec- 
trical power in the Agena bus as a result 
of a massive and progressive electrical 
short within the slip ring assembly of the 
-Y solar array. 

2) The electrical short was most probably 
initiated by an arc between adjacent com- 
ponents in the slip ring assembly. Possi- 
ble triggering mechanisms for this arc are 
momentary shorts caused by wire-to- 
brush assembly contact, brush-to-brush 
contact, or by a contaminant. 

3) The congested nature of the slip ring de- 
sign, coupled with a wiring arrangement 
for connecting the slip rings into the pow- 
er subsystem that resulted in most of the 
adjacent brush assemblies being of oppo- 
site polarity, made the Seasat slip ring as- 
sembly particularly prone to shorting. 

4) The combination of design and wiring se- 
quence used for the Seasat slip ring as- 
semblies made these unique, first-of-a- 
kind components. 

5) The possibility of slip ring failures result- 
ing from placing opposite electrical po- 
larities on adjacent brush assemblies was 
known at least as early as the summer 
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1977 to other projects within the prime 
contractor’s organization. That the Seasat 
organization was not fully aware of these 
potential failure modes was due to a 
breakdown in communications within the 
contractor’s organization. 

6) The failure to recognize the potential fail- 
ure modes of the slip ring assembly and to 
give this critical component the attention 
it deserved was due, in part, to the under- 
lying program policy and pervasive view 
that it was an existing component of a 
well-proven and extensively used stan- 
dard Agena bus. This program policy fur- 
ther led to a concentration by project 
management on the sensors and sensor 
module of the spacecraft to the near ex- 
clusion of the bus subsystems. In actual- 
ity, many of these subsystems, including 
the power subsystem, contained compo- 
nents that were neither flight proven nor 
truly qualified by similarity. 

7) Lack of proper attention by both Lock- 
heed and JPL Seasat program engineer- 
ing to the new and unproven components 
on the Agena bus resulted in several in- 
stances of both noncompliance with con- 
tractual, qualification and acceptance re- 
quirements and failure to document such 
noncompliances. 

8) The Failure Modes, Effects, and Critical- 
ity Analysis that was conducted for the 
electrical power subsystem did not consid- 
er shorts as a failure mode and thus did 
not reveal the presence of single point 
failure modes in the subsystem nor pro- 
vide a basis for the development of a full 
complement of safing command se- 
quences that could be used by the flight 
controllers in responding to anomalies. 

9) The strong desire on the part of all con- 
cerned to initiate the project as soon as 
possible resulted in inadequate time for 
an effective Phase B study. As a result, 
the project office did not have the opportu- 
nity to plan the activity thoughtfully and 
establish the preliminary designs, compo- 
nent evaluations, test plans, and other 


Phase B project plans before becoming en- 
gaged in the actual spacecraft develop- 
ment. 

Although unrelated to the failure of the Sea- 
sat, certain deficiencies in flight control pro- 
cedures were present that are worthy of note 
as a lesson for the future. The flight control- 
lers were not provided with an adequate set 
of safing command sequences to use in re- 
sponse to anomalies, were not sufficiently fa- 
miliar with the system they were controlling, 
received insufficient anomaly training and, 
during the failure event itself, failed to fol- 
low the prescribed procedures in response to 
the flight data available to them. Compound- 
ing these difficulties were the frequent 
breakdowns of the ground data acquisition 
and processing system throughout the mis- 
sion. 

It is ironic, and yet typical, of spacecraft 
failures that the termination of the Seasat 
flight was caused not by a malfunction of a 
new or sophisticated device, but by a failure 
in a very common component of a type that 
has flown in many spacecraft for many years. 
It is also ironic, and instructive, that the 
smallest of events or the slightest of commu- 
nications could have prevented the failure. 
Better clarity in an oral communication, a 
brief memorandum of the right kind at the 
right time, a failure report coming to the 
right person, or an alert engineer could have 
made all the difference. 

Basic to the Seasat mission was the con- 
cept of using an existing, flight-proven space- 
craft bus for the services and housekeeping 
functions required by the sensors in order to 
minimize program costs and to permit a con- 
centration of effort on the sensors and their 
integration into the spacecraft. Thus the use 
of a “standard Agena bus” as part of the Sea- 
sat spacecraft became an enduring tenet of 
the program. So firmly rooted was this prin- 
ciple in program philosophy that, even after 
the engineering staffs of both the govern- 
ment and the contractor were well aware of 
the final uniqueness of their Agena bus, the 
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words, and the associated way of doing busi- 
ness, persisted. They became deceived by 
their own words. 

Consistent with the concept of the “stan- 
dard Agena bus” was the policy decision to 
minimize testing and documentation, to 
qualify components by similarity wherever 
possible and to minimize the penetration into 
the Agena bus by the government. As a re- 
sult, a test was waived without proper ap- 
proval, important component failures were 
npt reported to project management, compli- 
ance with specifications was weak, and flight 
controllers were inadequately prepared for 
their task. Significantly, the Seasat slip ring 
assembly had no applicable flight history at 
the time of its launch and, in its application 
to the spacecraft, was a new device. 

There can, of course, be no quarrel with 
the policy of using existing and well proven 
equipment. The use of such equipment has 
certainly reduced the costs and contributed 
to the success of many space missions. But 
the world of space flight is an unforgiving 
one and words like “standard,” “existing,” 
and “similar to” can be traps for the unwary. 
The technical risks of using standard equip- 
ment can be as high as those present in a new 
or untried piece of equipment, but the ap- 
proach, both technical and managerial, must 
be different. For new equipment, one designs 
carefully, reviews thoroughly, and tests com- 
pletely — and that we know how to do. For 
standard equipment, one should diligently 
and thoroughly probe the heritage that justi- 
fies the classification and identify, compo- 
nent by component and piece by piece, those 
that are truly standard and those that are 
not. One should assume that each space vehi- 
cle is unique until proven otherwise. Then, 
for those parts that are standard or well 
proven, and that are applied in the same 
way, one can forego design, reviews, testing 
and extensive documentation. Conversely, 


components that are different should be 
treated as new. The policy of limited pene- 
tration into Seasat’s Agena bus by the gov- 
ernment was appropriate, but a limited pene- 
tration must be a selective penetration and 
not a reduced effort everywhere. 

This identification of the heritage of pre- 
viously used equipment, in both design and 
application, need not require a large staff or 
a lot of money. But it does take time, both at 
the start of the project and at the time of the 
Critical Design Review. And here, respond- 
ing to strong desires by all concerned to get 
the project on contract and underway, the 
Seasat project was denied the advantage of 
an effective Phase B study. Had there been 
an effective Phase B study period, prelimi- 
nary designs would have been completed, 
component selections better understood, test 
plans and qualification requirements better 
established, and possibly, the critical role 
and inherent complexities of the slip ring as- 
sembly might have been more apparent to 
the Seasat engineering staffs. Whether such 
a Phase B study period would have precluded 
the Seasat failure is, of course, uncertain for 
history does not reveal its alternatives. But 
such a carefully conducted planning and 
study period would have minimized the 
chances for the type of failure that did occur. 

The policy of using existing, flight-proven 
equipment can be both valid and cost effec- 
tive. But it is the main lesson of Seasat that 
an uncritical acceptance of such classifica- 
tions as “standard” can submerge important 
differences from previously used equipment 
in both design and in application. It is impor- 
tant, therefore, that thorough planning be 
conducted at the start of a project to fully 
evaluate the heritage of such equipment, to 
identify those that are standard and those 
that are not, and to establish project plans 
and procedures that enable the system to be 
penetrated in a selective manner. 
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